Networks

Ask something
Discussion Locked

Mozilla Firefox 3.0 Vulnerability

0 helpful
6 replies

by rkuhn040172

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

So, what's everyone think? It only took 5 hours!

http://dvlabs.tippingpoint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30

Mozilla is taking one on the chin here.

1) 5 hours after releasing their newest browser version, a vulnerability is found

2) Their marketing stunt goes wrong and their servers can't keep up.

Not a good 24 hours for them.

6 replies

by charliespencer

I caught so much flak around here for saying I was going to wait two weeks before I downloaded it.

I don't understand the urge to be among the first to have something, whether it's FF 3, an iPhone, Windows 95, etc. (Boy, those early iPhone adopters look more gullible with every passing day.) It's not like FF 3 is going to be unavailable next week. What's the freakin' rush?

by jdclyde

[i]"as well as prior versions of Firefox 2.0.x. "[/i]

The same exploit was in FF all along and no one exposed it until now. You still have that same exploit on your FF2.

by rkuhn040172

At least in the business world, being cutting edge or an early adopter usually doesn't pay off.

That said, if it is a well accepted business decision to not be an early adopter, why not follow the same advice in your personal life?

by jdclyde

No code is perfect. It is the group that quickly fixes known issues in a timely manner that is important. Something Microsoft has been more content to hide than fix problems.

The other important fact was the same exploit was in previous versions, so someone knew about it and sat on it waiting for 3 to come out, either trying to intentionally make FF look bad or just trying to make a name for themselves.

[i]"as well as prior versions of Firefox 2.0.x. "[/i]

by rkuhn040172

The same arguments could be said about Microsoft or any other software company.

Most hackers probably wait for new versions to come out, intentionally try to make a company look bad or try to make a name for themselves.

My opinion is that this is one (and only one) example of no matter how many eyes you have looking at a piece of software (aka one of the arguments for open source) "no code is perfect".

This vulnerability has been around for quite a while, as mentioned, why wasn't it found sooner?

Last question, and this one always bugs me, how many people out there that have access to code via open source actually ever look at the code?

Personally, just because I have access to some code, I don't think I'm smart enough to make heads or tails of it anyways.

This discussion is closed to new replies.